| Title | code-projects Hospital Information System 1.0 Information Disclosure |
|---|
| Description | The Hospital Information System (HIS) exposes an SQL database file named his.sql through a web-accessible application directory.
The vulnerability occurs because the database file is deployed within the web server's document root without adequate access restrictions. Consequently, an unauthenticated user may directly request /HIS/his.sql without first authenticating to the application.
SQL dump files commonly contain database definitions and may additionally contain stored application records. If his.sql contains both schema definitions and database records, successful retrieval could disclose the internal database structure as well as information maintained by the HIS application.
The actual confidentiality impact depends on the contents of the exposed file. Potentially sensitive material may include account information, authentication-related records, application configuration data, patient-related records, administrative information, or other data stored by the affected installation. These specific data categories should only be claimed in a vulnerability submission if they have been confirmed in the retrieved SQL file.
The issue does not require SQL injection or manipulation of application functionality. Exploitation consists of directly requesting a sensitive file that should not be available through the public web interface.
An attacker who obtains the database dump can analyze it offline to understand the application's database structure and any records contained within it. Such information may facilitate subsequent attacks against the affected installation.
The underlying security weakness is therefore the placement and exposure of a sensitive database file within a publicly accessible web directory, combined with insufficient web-server access controls. |
|---|
| Source | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Hospital%20Information%20System%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20SQL%20Database%20File.md |
|---|
| User | AhmadMarzouk (UID 95993) |
|---|
| Submission | 07/27/2026 20:20 (1 month ago) |
|---|
| Moderation | 09/06/2026 18:37 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399466 [code-projects Hospital Information System 1.0 SQL Database Backup File /HIS/his.sql information disclosure] |
|---|
| Points | 20 |
|---|